Extracted

• • Target
    76f4346f-d81c-465f-9d7b-fa5089c9ea3b
  • Size 93KB
  • SHA256 3c2d602ddfa3fb7fdc5aedc735a07cab7ee70a77e739070538d03dca17cd579d
  • MD5 ee116e25d12d750979ea54b7527cf371
  • SHA1 fb9b2d7c05088bbde599efa521888c7cdac0de3f
  • SHA512 1e8aa7bd22ce38eae6bcc2a8a4aefb64ab4b472704b64b124a86639c90e67656b10f05f76db3d0ae6d25e2b4cc50e4a85177370d191e8aed2ac31bcc6fbf28b3
  • SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdJ9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUn7u
  • TLSH
    T1109322053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionacrstealerstealer

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2